CVE-2026-18941

Received Received - Intake

Feast Remote Code Execution via Default No-Auth Configuration

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-18941

Affected Vendors & Products

Vendor	Product	Version / Range
feast	feast	*
feast	feast_operator	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is in Feast and feast-operator where the default configuration 'no_auth' lacks authentication. This allows unauthenticated access to feature-server, registry-server, and offline-server endpoints. Attackers can exploit this to execute remote code, cause denial of service by forcing feature re-materialization, or access cross-tenant data.

Detection Guidance

Check if Feast services (feature-server, registry-server, offline-server) are running with default 'no_auth' configuration. Inspect network traffic for unauthenticated access attempts to these endpoints. Review logs for suspicious UDF storage or cross-tenant data access patterns.

Impact Analysis

If you use Feast or feast-operator with default settings, attackers could gain unauthorized access to your servers, execute malicious code remotely, disrupt services by causing excessive resource usage, or steal sensitive data from other tenants sharing the system.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires strong authentication and data protection measures, while HIPAA mandates strict access controls for sensitive health data. The lack of authentication here could lead to unauthorized data exposure or breaches.

Mitigation Strategies

Enable authentication by configuring a security manager for Feast services. Restrict network access to feature-server, registry-server, and offline-server endpoints. Monitor for unauthorized UDF storage or cross-tenant data access. Update to a patched version if available.

Hi! I’m here to help you understand CVE-2026-18941. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70